From a1e7fd11d90d01fc5319d229b2eda08728e543b6 Mon Sep 17 00:00:00 2001 From: bdchatham Date: Tue, 28 Jul 2026 14:32:24 -0700 Subject: [PATCH 1/2] chore: release v0.0.25 (seed per-source-IP connection cap) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Carries #45: applySeedOverrides sets max_incoming_connection_attempts to 32. That key caps CONCURRENT connections per source IP rather than attempt rate, and upstream leaves it equal to max_connections (100/100) where it can never bind — so raising the seed total to 1000 had left one source able to hold ~10% of a seed's inbound. Also records that AllowDuplicateIP is inert: sei-tendermint declares and renders it but never reads it. Consumed next by seictl, whose sidecar renders config.toml (sidecar/tasks/config_apply.go) and is therefore what makes this real on a running node, and by sei-k8s-controller to keep its pin in sync. Co-authored-by: Claude Opus 5 (1M context) --- version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/version.json b/version.json index d06840a..2fd77a9 100644 --- a/version.json +++ b/version.json @@ -1,3 +1,3 @@ { - "version": "v0.0.24" + "version": "v0.0.25" } From aa851184ac7dac4fe80c688e567a929ec01fca8b Mon Sep 17 00:00:00 2001 From: bdchatham Date: Tue, 28 Jul 2026 15:05:25 -0700 Subject: [PATCH 2/2] docs(defaults): state consequences in present tense per xreview Comment-only; no behavior change. The giga comment described a prior tree state ("previously rendered"), which a reader cannot verify against the code in front of them. Restated as present fact, keeping the pin instruction for nodes that must stay on the v2 executor. The seed cap comment gave the mechanism ("multiplies against the LB's address count") without the consequence, so it read as benign re-accounting: under SNAT the ceiling collapses and legitimate peers are dropped, silently, because seed mode serves no metrics. It now leads with the silent-rejection property, says outright that this tightens 100 to 32, carries the measured basis for 32 (a fleet maximum of 8 real peers per address) so the number stays checkable, and records that the accept path is NodeID-blind and so bounds inbound persistent and unconditional peers too. Raised independently by idiomatic-reviewer and prose-steward while blinded. Ledger: bdchatham-designs designs/seed-node-mode/xreview/sei-config-v0.0.25-rollout.md Co-Authored-By: Claude Opus 5 (1M context) --- defaults.go | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/defaults.go b/defaults.go index 8a6ff9f..612c92b 100644 --- a/defaults.go +++ b/defaults.go @@ -228,10 +228,10 @@ func baseDefaults() *SeiConfig { LruSize: 1, }, - // Matches seid's own DefaultConfig (giga/executor/config). The zero - // value here previously rendered enabled=false into every app.toml, - // silently overriding the binary default; nodes that must stay on the - // v2 executor pin giga_executor.enabled=false explicitly. + // Mirrors seid's own DefaultConfig (giga/executor/config). Left at the Go + // zero value this field renders enabled=false into every app.toml and + // overrides the binary's own default; a node that must stay on the v2 + // executor pins giga_executor.enabled=false explicitly. GigaExecutor: GigaExecutorConfig{ Enabled: true, OccEnabled: true, @@ -295,13 +295,14 @@ func applySeedOverrides(cfg *SeiConfig) { // Kept because true is the right intent for a seed, but the limit that actually // applies is MaxIncomingConnectionAttempts below. cfg.Network.P2P.AllowDuplicateIP = true - // Caps CONCURRENT connections per source IP, despite the name. Upstream leaves - // it equal to max_connections (100/100) where it can never bind; raising the - // total to 1000 makes it the first real constraint. 32 gives one source ~3% of - // inbound — ample for an operator running several nodes behind one NAT, while - // forcing a flood across ~31 addresses. This assumes the load balancer in front - // preserves client IPs; under SNAT it multiplies against the LB's address count - // rather than the peers'. + // Caps CONCURRENT connections per source IP despite the name, and rejects + // silently: seed mode serves no metrics, so a wrong value yields no error and no + // counter. Tightens the inherited 100 to 32 — ~3% of the ~980 inbound to any one + // source, against a measured fleet maximum of 8 real peers per address, forcing a + // flood across ~31 addresses. Correct only while the load balancer preserves + // client IPs: under SNAT the cap applies per LB address instead, collapsing the + // ceiling to 32 x (LB addresses) and dropping legitimate peers. The accept path + // is NodeID-blind, so this also bounds inbound persistent/unconditional peers. cfg.Network.P2P.MaxIncomingConnectionAttempts = 32 // Bounds the PEX recv path only, where ReadSizedMsg allocates a peer-declared // size before the channel's ~26 KB RecvMessageCapacity can reject it. The